Skip to content

[Response Ops][Rules] Cases action title length too long #217007

@jcger

Description

@jcger

Kibana version:
main

Describe the bug:
No case created because of

[ERROR][plugins.actions] Action 'system-connector-.cases' failed: an error occurred while running the action: Failed to bulk create cases: Error: The length of the title is too long. The maximum length is 160.
[ERROR][plugins.taskManager] Task actions:.cases "657e6690-0648-47e0-bc00-5b1fe4e87577" failed: Error: an error occurred while running the action

Steps to reproduce:

  1. Create a rule with a very long name
  2. Add case action and use kibana.alert.rule.name as group by alert field
  3. Trigger an alert
    Note It also has been triggered using kibana.alerts.case_ids as group by fields. I guess it just needs enough case_ids in the array

Expected behavior:
It should create a case

Any additional context:
We have a guardrail function that doesn't seem to be working as expected. It seems to be trimming the rule name and then adds "... - Grouping by [the rule name]" to it which makes the initial trimming pointless. Without having dug to much into the issue it seems like we should check the end result doesn't exceed the max length too.

Rule name used by me to test this
Elasticsearch query rule Elasticsearch query rule Elasticsearch query rule Elasticsearch query rule Elasticsearch query rule Elasticsearch query rule Elasticsearch query rule Elasticsearch query rule Elasticsearch query rule Elasticsearch query rule Elasticsearch query rule Elasticsearch query rule Elasticsearch query rule Elasticsearch query rule Elasticsearch query rule Elasticsearch query rule Elasticsearch query rule

Metadata

Metadata

Labels

Team:ResponseOpsPlatform ResponseOps team (formerly the Cases and Alerting teams) t//bugFixes for quality problems that affect the customer experience

Type

No fields configured for Bug.

Projects

No projects

Milestone

No milestone

Relationships

None yet

Development

No branches or pull requests

Issue actions